Security audit
Security checks for vulnerabilities and agentic risk
This is a simple Chinese-language flight and travel guidance skill with some broad wording, but no executable code, hidden behavior, credential access, or persistence.
Install only if you want Chinese-language travel and flight check-in guidance, and verify live travel policies, offers, inventory, weather, and insurance advice with official airline or travel sources before acting on it.
All user-facing natural-language content in the skill is presented exclusively in Chinese, and the file does not indicate that language selection is optional or user-driven. Under the stated policy, a language or locale constraint should either be opt-in or clearly justified as region-specific.
The skill metadata says it handles online seat selection, baggage rules, and delay-certificate guidance, but the body expands into broad travel search, ticket inventory, destination guides, weather, and spending references. This scope drift can cause the agent to invoke the skill for unrelated requests, increasing unintended data access, user confusion, and unsafe overreach beyond the declared purpose.
The example trigger phrases are extremely broad and match ordinary help-seeking language like asking how to use the skill for a 'specific scenario task' or for 'latest tips/offers.' Overlapping triggers increase the chance of accidental activation on unrelated conversations, which can route users into the wrong workflow and expose them to unexpected actions or misleading travel information.
No suspicious patterns detected.
